AppSec Europe 2016

For years security nerds like us have been saying the same thing: It’s *your* problem. Integrate security awareness throughout your SDLC, educate your developers, hire us at some expense to come in and tell you the same annually. Ultimately relying on developers to be infallible is an expensive loosing proposition. 

We’d like to present a different idea: It's our problem. Writing secure software shouldn't require developers to become security specialists. At Immunio we've been working on ways of modifying application frameworks to defend against common vulnerabilities automatically. We're trying to remove some of the burden on developers and make security a fundamental part of the stack. 

In this presentation we'll share with you our experiences extending these frameworks and discuss some of the strategies we've taken that have worked, the challenges we've had to face, and how a simple change of approach could change application security. 

Outline: 

- Introduction 
- The Problem: Frameworks make coding easy and security hard 
- Example: Rails helpers and safe_buffers 
- Example: Rails directory traversal 
- Application Defense In Depth 
- The trouble with WAFs 
- Security is a framework responsability 
- Perfect Code is a Pipe Dream 
- State Makes Hard Problems Easy(ish) 
- Today Security is an Afterthought 
- Building Self-Defending Frameworks 
- Problem: Command and Control 
- Everything You Know About XSS Defense Is Wrong 
- ESAPI is Crapy 
- HTML Is Machine Readable By Design! 
- Use The Source Luke! 
- Using Lexical Analysis To Escape On-the-fly 
- Lexing to Determine Context 
- Escaping 
- Problem: Application Interpolations 
- Dynamic Whitelisting 
- Problem: HTML Is a Horrible Mismash 
- Protecting Javascript 
- CSS 
- Problem: HTML Is Just Horrible 
- Browser Insanity 
- 'Developer' Insanity 
- DEMO 
- Generalizing The Approach 
- SQLi 
- Problem: String building 
- Bash 
- Everything Is Just Structured Data! 
- The Power of a Security Aware Framework 
- Attacker Identification 
- Active Response 
- Forensics 
- Conclusion